Application Security Engineer Senior

Build safer applications with Starbucks as a Senior Application Security Engineer in Nashville, TN (onsite). This role focuses on developing and executing application security engineering program practices, pairing hands-on security work with guidance that helps technology platforms meet established standards and policies. You will also have the opportunity to leverage AI-driven capabilities when they can improve speed, accuracy, and scale.

Responsibilities

• Own application security services including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
• Build and continuously improve application security services using a fresh perspective, including AI-driven capabilities where they can increase speed, accuracy, and scale.
• Partner with other cybersecurity teams to facilitate threat remediation, providing expert analysis and context.
• Bring deep expertise in source code management platforms and CI/CD workflows such as GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with strong secure cloud deployment workflow knowledge.
• Provide hands-on expertise explaining and correcting OWASP Top 10 and SANS Top 25 issues.
• Evaluate AI-provided analysis for accuracy, risk relevance, and remediation quality, ensuring outputs are validated before being used to guide decisions.
• Recommend changes and improvements to toolsets, development processes, and production application security support.
• Contribute to the development and delivery of security training programs.
• Participate as a key member in security incident response activities.

Requirements

• Bachelor’s degree in a relevant field or 5+ years of equivalent experience in cybersecurity engineering related roles.
• 6+ years of experience working in an information technology discipline.
• 6+ years of infrastructure or information security experience.
• 4+ years of experience working with infrastructure as code technologies.
• Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments.
• Certifications such as CISSP, CISSM or others focused on cybersecurity, data privacy, or information risk management.
• Advanced knowledge of cybersecurity principles and practices, including experience with firewalls, antivirus software, and intrusion detection systems.
• Experience with security frameworks and compliance requirements, and proficiency implementing and managing security controls and technologies.
• Knowledge of network security protocols and concepts; familiarity with operating systems and network architectures.
• In-depth understanding of enterprise-level cybersecurity strategies, frameworks, and technologies.
• Proficiency in conducting security assessments and audits, and ability to develop and implement security policies and procedures.
• Experience managing and responding to security incidents.
• Exceptional problem-solving and troubleshooting skills; excellent communication and collaboration skills with cross-functional stakeholders.
• Advanced experience with at least one modern programming language: Java, Go, Python, Ruby, C++, or C#.
• Advanced proficiency interacting with APIs and automating tasks using common scripting languages.
• Ability to apply multidisciplinary business principles to achieve outcomes in cross-functional projects and activities.
• Proficiency with Microsoft Word, Excel, and PowerPoint.
• Ability to work within large collaborative organizations; knowledge and ability to apply process improvement principles.
• Strong written, verbal, and active listening skills, and alignment with Starbucks guiding principles.
• Foster effectiveness during changes in tasks, work environment, or conditions affecting the organization.
• Strong analytical and problem-solving skills, with ability to balance multiple priorities and meet deadlines.

Preferred Qualifications

• Development expertise in 2+ of: Python, JavaScript, C#, Java, Scala, Objective-C, Swift, Kotlin.
• Understanding of PCI practices and experience working with PCI environments.
• Experience with cloud platforms such as AWS and Azure from both a developer and security perspective.
• Experience working with Bug Bounty or VDP programs.
• Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.).
• Skilled at performing security focused application design reviews and static and manual code reviews.
• Experience using common security testing tools and techniques for security assessments across multiple platforms, with significant expertise in either web or mobile penetration testing.
• Experience implementing and operating static and dynamic analysis tools.
• Strong understanding of authentication and authorization options and standards.
• Deep knowledge of security vulnerabilities, including identification, risk assessment, and remediation guidance.
• Experience as a software engineer and knowledge of modern web, mobile, and API development practices.
• Ability to read and write code in multiple programming languages.
• Experience with Git and GitHub and knowledge of CI/CD practices.
• Experience incorporating security requirements into an SDLC.

Benefits

• Medical, dental, vision
• Basic and supplemental life insurance; other voluntary insurance benefits
• Short-term and long-term disability
• Paid parental leave, plus family expansion reimbursement
• Paid vacation starting from date of hire; sick time accrued at 1 hour per 25 hours worked
• Eight paid holidays and two personal days per year
• 401(k) retirement plan with employer match (eligible partners)
• Discounted company stock program (S.I.P.) and Starbucks equity program (Bean Stock)
• Incentivized emergency savings; financial well-being tools
• 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan
• Student loan management resources and access to other educational opportunities
• Access to backup care and DACA reimbursement

Compensation: USD 112,400 - 187,400 per year.

Technologies you may work with: SAST, DAST, SCA, GitHub Enterprise, GitHub Cloud, GitLab, Azure Devops, OWASP Top 10, SANS Top 25, CISSP, CISSM, firewalls, antivirus software, intrusion detection systems, infrastructure as code technologies, Java, Go, Python, Ruby, C#, APIs.